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Why GAO Did This Study 

Congress has continuing interest in 
commercial activities in U.S. public 
schools. These include product 
sales, advertising, market research, 
and the commercial use of personal 
data about students (such as 
names, addresses, and telephone 
numbers) by schools. To update 
information about commercial 
activities in schools, Congress 
asked us to answer the following 
questions: (1) Since 2000, what 
statutes and regulations have states 
enacted and proposed to govern 
commercial activities in schools? 
(2) To what extent have districts 
developed policies implementing 
amended provisions of the 
Protection of Pupil Rights 
Amendment (PPRA) in the No 
Child Left Behind Act on the use of 
student data for commercial 
purposes? (3) What guidance has 
the Department of Education 
(Education) disseminated? 

To answer these questions, we 
researched state laws, surveyed a 
national sample of school districts, 
analyzed policies provided by 
districts, interviewed officials at 
Education, and examined its 
guidance. In addition, we updated 
findings from the districts we 
visited in 2000. 



What GAO Recommends 



We recommend that Education 
disseminate to state school boards 
associations its guidance on the 
use of student data for marketing 
and selling purposes. Education 
agreed with our recommendation. 



www.gao.gov/cgi-bin/getrpt7GAO-04-810. 

To view the full product, including the scope 
and methodology, click on the link above. 

For more information, contact Mamie Shaul at 
(202) 512-7215 or shaulm@gao.gov. 



What GAO Found 

Since we reported on commercial activities in 2000, 13 states have 
established laws addressing commercial activities in public schools, and at 
least 25 states are considering such legislation. Of the states establishing 
new laws, 6 established laws affecting market research by addressing the 
use of student data for commercial activities. Almost all of the proposed bills 
target the sale of food and beverages. Prior to 2000, 28 states established 
laws addressing commercial activities, particularly product sales and 
advertising. At that time, only 1 state passed a provision affecting market 
research. 

PPRA provisions required districts to implement policies on the collection, 
disclosure, or use of student data for marketing and selling purposes, and we 
estimate that about two-thirds of the districts in the nation believe they are 
developing or have developed such policies. However, of the 61 districts 
that sent us policies, only 19 policies addressed these issues. No district 
reported having collected student data for commercial purposes. Only a few 
reported disclosing student information for these purposes, and all had done 
so for school-related purposes such as graduation pictures. 

Education has undertaken several activities, such as sending guidance to 
state education agencies and school district superintendents and posting 
information on its Web page, to inform districts about the student 
information provisions of PPRA, but many districts appear not to understand 
the new requirements. Some districts told us that they relied on their state 
school boards association to develop policies for them because state school 
boards associations address federal and state laws. School districts in one 
state sent us policies that addressed commercial activities that had been 
developed by their state school boards association. Education was not 
required to disseminate guidance to associations of local school boards in 
each state and has not done so. 



District Policies Addressing the Commercial Use of Student Data (N = 61) 




Districts with policies addressing the collection, use, and 
disclosure of student data for commercial purposes 



Districts with policies addressing only the disclosure of 
student data for commercial purposes 



Districts with policies that did not address the 
commercial use of student data 
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Accountability * Integrity * Reliability 



United States Government Accountability Office 
Washington, DC 20548 



August 20, 2004 

The Honorable Christopher J. Dodd 
Ranking Minority Member 
Subcommittee on Children and Families 
Committee on Health, Education, Labor, and Pensions 
United States Senate 

The Honorable Richard C. Shelby 
United States Senate 

Over the past decade, public schools and businesses have been forging 
new types of relationships to help each other achieve their educational 
and business-related goals. In some of these relationships, business’ 
apparent focus is on improving teaching and learning, but in others, the 
apparent focus is on developing product loyalty and increasing sales. In 
recent years, Congress and the public at large have become increasingly 
interested in the mixing of school activities with commercial enterprise. 
Some parties have wanted to limit such relationships by restricting 
product sales, advertising, market research, and the commercial use of 
personal data about students (such as names, addresses, and telephone 
numbers) by schools. However, others have promoted business 
relationships with schools as a desirable and necessary way to generate 
additional funding and resources for students. 

We first reported on product sales, direct and indirect advertising, and 
market research in schools in 2000. 1 At that time, we found state laws and 
district school board policies governing commercial activities were not 
comprehensive, and in most states, local school officials were responsible 
for making decisions about commercial activities. In addition, we found 
that the visibility and profitability of commercial activities varied widely 
and the high schools we visited had more commercial activities than the 
middle or elementary schools. 

Since then, some changes related to these commercial activities have 
occurred. Schools are facing even greater needs for funds; the use of the 



^AO, Public Education: Commercial Activities in Schools, GAO/HEHS-OO-156 
(Washington, D.C.: Sept. 8, 2000). 
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Internet as a marketing tool has expanded; and through the No Child Left 
Behind Act (NCLBA) of 2001, Congress has legislated new protections 
regarding the collection, disclosure, and use of student data for marketing 
or selling purposes. For decades, federal law has safeguarded the release 
of student education records and has allowed parents some control over 
the use of information about their children. For example, federal law has 
prohibited districts from releasing students’ Social Security numbers 
without parental approval. However, NCLBA established new safeguards 
about the use of student data for marketing or selling purposes. 
Specifically, NCLBA amended the Protection of Pupil Rights Amendment 
(PPRA) of 1994 addressing pupil privacy by requiring school districts to 
develop a policy on the collection, disclosure, and use of personal data 
about students for commercial purposes that includes requirements for 
parental notification and permission. Finally, there has been growing 
concern about childhood obesity and whether the sale of beverages and 
food outside those offered by school breakfast and lunch programs might 
contribute to this problem. 

In view of these developments, you asked us to examine efforts by states 
to regulate a broad range of commercial activities in public schools and 
determine how districts have followed through with the PPRA provisions 
about the collection, disclosure, or use of student data for marketing and 
selling purposes. We conducted research to answer the following 
questions: (1) Since 2000, what statutes and regulations have states 
enacted to govern commercial activities in schools and what proposed 
legislation are states considering? (2) To what extent have districts 
developed policies implementing the PPRA provisions in NCLBA on the 
use of student data for commercial purposes? (3) What is the Department 
of Education (Education) doing to help districts implement the new 
provisions on the use of student data for commercial purposes? 

To answer these questions, we reviewed state laws and regulations in all 
50 states and Washington, D.C., as of May 2004. Also, we reviewed 
proposed legislation that had been introduced between January 1, 2003, 
and February 2004 to obtain a snapshot description of possible future state 
legislative activities. We conducted a national sample survey of school 
districts to determine if their policies were consistent with the PPRA 
provisions on the use of student data for commercial activities and asked 
them to report on any activities in which they engaged that used student 
data for commercial purposes. We obtained an 87 percent weighted 
response rate. We also asked superintendents in the districts we surveyed 
to send us copies of their policies that govern activities involving the use 
of student information for marketing and selling purposes. We evaluated 
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the extent to which these policies implemented PPRA requirements by 
examining whether they covered the collection, disclosure, and use of 
student data for commercial purposes. To discern changes in commercial 
activities in the seven school districts we visited in 2000, we interviewed 
district and school officials in those districts by telephone. We had 
selected these seven districts, located in California, Michigan, and New 
Mexico, to illustrate a range of commercial activities in states identified as 
having legal frameworks generally supportive of such activities as well as 
a range of geographic, economic, and demographic characteristics. 

Finally, we interviewed officials at Education and examined its guidance 
and initiatives on PPRA’s commercial provisions. See appendix I for a 
detailed explanation of our scope and methodology. We conducted our 
work between November 2003 and August 2004 in accordance with 
generally accepted government auditing standards. 



Results in Brief 



Since our previous report in 2000, 13 states have enacted 15 statutory 
provisions and issued 3 regulatory provisions that pertain to commercial 
activities in public schools, and since January 1, 2003, we identified 25 
states in which legislators have proposed laws that address commercial 
activities. Of the 13 states establishing new laws, 6 established provisions 
addressing the collection, disclosure, or use of student information for 
marketing and selling purposes. For example, Colorado enacted a law 
prohibiting student participation in any survey without written parental 
consent. Other new provisions addressed product sales and advertising. 
Most of the proposed bills targeted food and beverage sales. Prior to 2000, 
28 states had passed laws or regulations pertaining to commercial 
activities. Almost all of these provisions addressed direct advertising and 
product sales. At that time, only one state had passed a provision relating 
to the use of student data for commercial purposes. The seven districts we 
visited in 2000 continue to conduct a variety of commercial activities, 
particularly product sales, and three districts told us that they have 
increased the level of activities with local businesses. However, the types 
of activities in these districts have not substantially changed. 

Based on the responses to our survey, we estimated that about two-thirds 
of the school districts in the nation had developed or were developing 
policies addressing PPRA requirements concerning the commercial use of 
student data. However, for the 61 districts that voluntarily provided us 
policies they had developed, we concluded that only 19 of these policies 
specifically addressed the commercial uses of student data. Regardless, no 
district reported having collected student data specifically for marketing 
purposes, and those we spoke to who had released student names, 
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addresses, or telephone numbers for marketing or selling purposes said 
they did so for school-related purposes, such as graduation pictures. Three 
of the seven districts we visited in 2000 reported that they had 
subsequently adopted new policies banning or restricting the use of 
student data, although none collected student data for commercial 
purposes. One of the seven released information in order for seniors to 
obtain class pictures, class rings, and graduation announcements. 

Education has taken steps to inform districts about the added student data 
safeguards included in PPRA, but many policies that districts provided to 
us did not specifically address the collection, disclosure, or use of student 
information for commercial purposes. Education has issued guidance 
advising districts that if they do not already have such a policy, they must 
develop and adopt one and notify parents. The department also provided 
districts with model notification information that districts could use to 
inform parents, posted relevant information on its Web site, and covered 
the provision in some of its training activities. However, only 19 of the 61 
districts that responded to our request sent policies that did address 
commercial activities. District officials in several states reported that they 
relied on state school boards associations for help in developing policies. 
In addition, two districts in one state sent us policies that had been 
developed by their state school boards association. Although Education 
has disseminated its guidance to school districts and state education 
agencies, it has not disseminated this guidance directly to the school 
boards association in each state. 

We recommend that the Secretary of Education take additional action to 
assist districts in understanding that they are required to have specific 
policies in place for the collection, disclosure, and use of student 
information for marketing and selling purposes by disseminating its 
guidance to state school board associations. In commenting on a draft of 
our report, Education agreed with our recommendation. 



Background 



As we reported in 2000, commercial activities in school can generally be 
classified in four categories — product sales, direct advertising, indirect 
advertising, and market research — although each category encompasses a 
wide range of activities. 2 For example, advertising activities could range 
from selling advertisements for a high school football game to selling 



Z GAO/HEHS-00-156. 
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naming rights to a school. Although this report synthesizes statutes, 
regulations, and proposed legislation addressing all four categories, our 
discussions of school district policies and Education’s activities focus on 
the fourth category, market research, because of the amendments made by 
NCLBA that place requirements on districts that deal with the collection, 
disclosure, and use of student data for marketing and selling. (See table 1.) 



Table 1 : Categories of Commercial Activities 



Commercial 

activities Examples 



Product sales 




Product sales benefiting a school district, school, or student 
activity, such as the sale of beverages or food within schools 
Cash or credit rebate programs 

Fundraising activities, such as the short-term sales of gift wrap, 
cookie dough, or candy, to benefit a specific student population 
or club 


Direct advertising 




Signage and billboards in schools or school facilities, and on 
school buses and shelters 

Corporate logos or brand names on school equipment, such as 
marquees, message boards, or scoreboards 
Ads, corporate logos, or brand names on book covers, student 
assignment books, or posters 

Ads in school publications, such as newspapers or yearbooks 
Media-based advertising, such as ads on Channel One or 
Internet sites 

Free samples, such as food or personal hygiene products 


Indirect advertising 




Corporate-sponsored educational materials, teacher training, 
contests, incentives, grants, or gifts 


Market research 




Surveys or polls related to commercial activities 
Internet surveys or polls asking for information related to 
commercial activities 

Tracking students’ Internet behavior and responses to 
questions calling for personal identification at one or more Web 



sites 



Source: GAO/HEHS-OO-156. 



In recent years, the growth of the Internet has had a large impact on 
commercial activities, particularly market research, by enabling marketers 
to elicit aggregated and personally identifiable information directly from 
large numbers of students. For example, some Web filtering systems used 
in schools that block student access to certain Web sites also allow the 
company that maintains that software to measure and analyze how 
children use the Internet by tracking which Web sites they visit and how 
long they stay there. Although this information is aggregated and does not 
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identify particular children, this information, especially when used with 
demographic data, can help businesses develop advertising plans that 
target particular audiences if districts allow the installation of the 
software. Also, Web sites directly elicit the participation of students in 
market research panels by offering them cash or prizes in exchange for 
information about themselves and their preferences. This makes it 
possible for companies to engage large-scale customized panels of 
students to test out marketing strategies and provide data to develop 
product lines and product loyalty without relying on schools. 



NCLBA Amends Statutory 
Safeguards on the Use of 
Student Data for Marketing 
and Selling Purposes 



NCLBA addresses some concerns about commercial activities and student 
data by amending and expanding certain student data safeguards that 
were established in PPRA . 3 Prior to NCLBA, PPRA generally prohibited 
requiring students to submit to a survey concerning certain personal issues 
without prior written parental consent. As amended, PPRA 4 for the first 
time requires districts to develop and adopt new policies, in consultation 
with parents, for collecting, disclosing, and using student data for 
marketing or selling purposes . 5 Districts are also required to directly notify 
parents of these policies and provide parents an opportunity to opt their 
child out of participation in such activities. Furthermore, districts are 
required to notify parents of specific activities involving the collection, 
disclosure, and use of student information for marketing or selling 
purposes and to provide parents with an opportunity to review the 
collection instruments. PPRA did not contain deadlines for districts to 
develop policies. Also, PPRA requires Education to annually inform each 
state education agency and local school districts of their new obligations 
under PPRA. Finally, PPRA continues to require Education to investigate, 
process, and adjudicate violations of the section. 



3 See 20 U.S.C.§1232h(c)(l)(E)(Supp. 2003). 

4 In this report we are not addressing other amendments to PPRA, which established 
requirements for surveys unrelated to marketing and selling and nonemergency invasive 
physical examinations. 

5 If a school district already had a policy in place on January 8, 2002, that addressed the 
collection, disclosure, or use of student data for commercial purposes, the amendments do 
not require the district to adopt a new policy. See U.S.C. §1232h(c)(3). 
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FERPA and PPRA 
Safeguards Address 
Different Student Privacy 
Issues 



For the past 30 years, student and parent privacy rights related to students’ 
education records have been protected primarily under the Family 
Educational Rights and Privacy Act (FERPA), which was passed in 1974. 
FERPA protects the privacy of students’ education records by generally 
requiring written permission from parents before records are released. 
FERPA also allows districts to classify categories of information as 
publicly releasable directory information so long as the district has 
provided public notice of what will constitute directory information items 
and has allowed parents a reasonable period of time to advise the district 
that directory information pertaining to their child cannot be released 
without consent. Under FERPA, directory information may include a 
student’s name, telephone number, place and date of birth, honors and 
awards, and athletic statistics. Unlike PPRA, FERPA does not address the 
participation of students in surveys or the collection, disclosure, or use of 
student data for marketing or selling purposes. (See table 2.) As a result of 
the NCLBA amendments, Education is required to annually inform each 
state and local education agency of the educational agency’s obligations 
on PPRA and FERPA. 6 



6 See 20 U.S.C. §1232h(c)(5)(c)(Supp. 2003). 
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Table 2: Comparison of Selected PPRA and FERPA Provisions 



Provisions 


PPRA 


FERPA 


Activities 

targeted 


Collection, disclosure, or use of personal student data 
for marketing or selling purposes 

Survey, analysis, or evaluation concerning political 
affiliations or beliefs; psychological problems; sexual 
behavior or attitudes; self-incriminating behavior; critical 
appraisal of individuals with whom respondents have 
close relationships; privileged relationships; religious 
beliefs; or income (other than that required by law to 
determine program eligibility) 

Nonemergency invasive physical examinations of children 


Disclosure of students’ education records 

Inspection, review, and amendment of education 
records 


Definitions of 
personal 
student data 


Individually identifiable information including: 

Name 

Address 

Telephone number 
Social Security number 8 


All student information contained in education records 

Each district can define a subset of information called 
“directory information” that is generally not considered 
harmful or an invasion of privacy to release, such as 
name, address, telephone number, height and weight (if 
an athlete), and scholastic honors and awards 3 


Notification 


Districts must directly notify parents of policies regarding 
the collection, release, or use of student data 


Districts must notify parents of the categories of 
information it has designated as directory information 



Districts must give parents an opportunity to exclude their Districts are to notify parents of students of their right to 

child’s participation in specific activities or to prevent the opt out of the disclosure of directory information 

release of information about their child except for certain 
types of educational activities and for the armed services 



Source: GAO analysis. 

“There are restrictions on the use of Social Security numbers. See GAO, Social Security Numbers: 
Use Is Widespread and Protections Vary, GAO-04-768T (Washington, D.C.: June 15, 2004). 
Consequently, districts would not designate students’ Social Security numbers as part of directory 
information. 



School District Policies 
Are Set at the Local Level 
under State Laws 



State education laws are enacted by state legislatures and administered by 
each state’s department of education, which is led by the state’s chief state 
school officer. The Council of Chief State School Officers represents 
states’ education interests in Washington, D.C., and acts as a conduit of 
information between the federal government and the states regarding 
federal education laws. Each state department of education provides 
guidance and regulations on state education laws to each school district. 



School district policies are generally set by local school boards according 
to the authority granted to them by state legislatures. The policies are then 
administered by the school district’s superintendent and other school 
district staff. Local school boards in each state have come together to form 
a state school boards association. They provide a variety of services to 
their members including help on keeping their local school board policies 
current. For example, a partial list of services offered by one school board 
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association includes policy development services, advocacy, legislative 
updates, legal services, executive search services, conferences and 
training, and business and risk management services. 



Since 2000, Most 
States Have Enacted 
Laws and Proposed 
Legislation That 
Affect Commercial 
Activities in Schools 



Since 2000, 13 states have established statutes, regulations, or both that 
address one or several categories of commercial activities in schools. Six 
of these states established provisions addressing market research by 
restricting the use of student data for commercial activities and for 
surveys. Other states passed statutes or issued regulations addressing 
product sales and advertising. In addition, as of February 2004, at least 25 
states are considering proposed legislation that would affect commercial 
activities. Most of these proposals would affect product sales, particularly 
the sale of food and beverages. Prior to 2000, 28 states had passed 
provisions addressing commercial activities. At that time, most provisions 
addressed direct advertising and product sales. The seven districts we 
visited in 2000 continued to conduct a variety of commercial activities, 
particularly product sales, and three districts reported that they have 
increased the level of activities with local businesses. However, the types 
of activities in these districts have not substantially changed since our 
visit. 



State Statutes and 
Regulations Vary Widely in 
Purpose and Scope 



Since our previous report in 2000, 13 states have enacted 15 statutory 
provisions and issued 3 regulatory provisions addressing one or more 
types of commercial activities in schools. Six states passed legislation 
affecting marketing research. Three of these 6 passed laws restricting the 
disclosure or use of student data for commercial purposes, and another 3 
placed restrictions on students’ participation in surveys. For example, an 
Illinois statute prohibited the disclosure of student data to businesses 
issuing credit or debit cards, and a New Mexico regulation prohibited the 
sale of student data for commercial reasons without the consent of the 
student’s parent. Laws in Arizona, Arkansas, and Colorado prohibited 
student participation in surveys without the consent of their parents. Five 
states passed new provisions affecting product sales. In most cases, these 
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